The vulnerability is a stored Cross‑Site Scripting flaw caused by the FluentForm plugin's failure to properly neutralize user‑supplied input. Exploitation allows an attacker to inject JavaScript that executes when other users load a page that displays the stored data. This can lead to cookie theft, session hijacking, defacement or phishing attacks. The issue does not provide direct code execution on the server, but it can compromise confidentiality and integrity of user data for site visitors. The weakness is identified as CWE‑79.

FluentForm, a WordPress contact and form building plugin developed by WP ManageNinja LLC, is vulnerable in all releases up to and including version 6.2.14. The fix is available in version 6.2.15 and later. Administrators of sites that use any affected FluentForm installation should verify the plugin version and plan an upgrade.

The CVSS score of 6.5 reflects a moderate impact. EPSS is not available, so the likelihood of exploitation is currently unknown, though the vulnerability is common enough to be of concern. It is not listed in CISA's KEV catalog, indicating no confirmed widespread exploitation. Exploitation requires the attacker to be able to submit or modify form content that is rendered without proper sanitization, typically through a user‑visible form or via an admin user. Because the injected code runs in the context of site visitors, any user who views form pages could be affected.